Hello,
A security colleague or a basis colleague will do it.You can use T-code SUGR to create the user groups in the production client of the system.Then assign it to the users in SU01.You can also use SU10 to change user group of multiple users.
Regards
A Pandit